Built so we can’t read your encrypted mail.
Messages you send with end-to-end encryption are locked on your device. We only store the locked copy.
How a message travels
Follow one message from your device to theirs.
-
Your device locks it
Your browser or app scrambles the message with RSA-4096 and AES-256 before anything is sent.
-
Our servers store the locked copy
We can’t open it, even if the law forces us to hand it over. Messages sent with a password-protected link are protected the same way.
-
Their device opens it
Only people with a SipherMail account can open it, using their own key. You can write to several people at once.
Illustrative, with demo content.
Private links for people not on SipherMail.
Send a link that expires. Add a password for extra protection, and share the password another way, like a call or a text.
Link expires after
What we can and can’t read.
We won’t tell you we can’t read any of your mail. That is only true for end-to-end encrypted mail. Here is the honest picture.
| Type of mail | How it is protected | Can SipherMail read it? |
|---|---|---|
| Mail between SipherMail users | End-to-end encrypted. Locked on the sender’s device. Only the recipient can open it. | No |
| Expiring link to someone outside SipherMail, with a password | The recipient opens a link and enters the password you shared. | No |
| Expiring link, without a password | Anyone with the link can open it until it expires. | Technically yes |
| Mail from other services, and ordinary mail you send to them | Protected in transit and at rest, like standard email. | Technically yes |
Under the lid
What we can see
Ordinary email from other services arrives readable to our servers, like all standard email. It is protected in transit and encrypted at rest. End-to-end encryption protects the messages you choose to send that way.
Links that expire
For people without SipherMail, send a link that expires after 1 hour, 1 day, 1 week or 4 weeks. Add a password and we can’t read the message. Without one, anyone with the link can open it.
Your keys stay protected
Your private key is locked before it is stored, using a passphrase on the web or a key in your phone’s secure storage. We can’t unlock it. We use 310,000 rounds of hashing (PBKDF2) so guessing a passphrase is very slow.
The same everywhere
The website and the phone apps use the same encryption format (SIPHER-E2EE-V1), so a message opens on any of your devices.
Hosted in the EU
Our own dedicated servers, not shared cloud space. European privacy law (GDPR) applies, and business customers can request a data processing agreement.
AI you can switch off
Privacy mode turns every AI feature off for your account. We don’t show ads or sell your data.
Safe sign-in
Two-step sign-in with an authenticator app, backup codes, and the option to sign out your other devices remotely.
Scams spotted early
Check a message for fake senders and risky links. Known tracking pixels are removed, and images load through our privacy proxy.
Your data stays yours
Export mail, contacts and settings in standard formats. Ask us to delete your account and it is scheduled for removal after 30 days. You can change your mind until then.
Free to leave
Use SipherMail inside other mail apps, and take your mail with you any time.
Found a vulnerability?
Open a support ticket from inside the app and we’ll respond privately.